2 ms·

WordPress is insecure by design. tl;dr: Use a static site generator. The biggest reason is that its pages are not statically generated and allows for code exe

by sshine 5y ago

WordPress is insecure by design. tl;dr: Use a static site generator. The biggest reason is that its pages are not statically generated and allows for code execution when they contain no dynamic content. The second biggest reason is the marketplace for plugins and themes; even if WordPress security audited their entire standard release, every single theme or plugin you install could compromise your installation. You’d think of a theme as something that provides colors and spacing, but they’re fully executable programs. WordPress is conveniently written in PHP, which attracts inexperienced programmers with no understanding of web security. The attack that OP links to is a supply-chain attack made possible by WordPress’es software architecture, but it could have happened on most more secure alternatives if they were equally popular. So while it’s easy to ridicule WordPress for having no security and a poor architecture to withstand most attacks, we mustn’t forget that it’s a combination of its huge popularity and the ease of use caused by its simplistic choices that has lead to this breach.

sdze 5y ago
> WordPress is insecure by design. Is there a proof for that?
blowski 5y ago
If the critics spent as much time building and selling what they see as the “better option” to WordPress, perhaps we wouldn’t be in this place. As it is, they just do the easy thing, playing “pigeon chess” by making these hackneyed, unsupported assertions. A better assessment is that WordPress has made trade-offs regarding security, as anybody in the real world must. Individuals must also make their own trade-offs, including whether to run WordPress at all, then how to configure it and which third-party code to use. Sometimes we get the trade-offs wrong, and that should affect how people make future decisions.
simion314 5y ago
>tl;dr: Use a static site generator. Most People that use WordPress are not develoeprs or technical people. Find similar product with a WYSIWYG GUI , theme , plugins, cheap hosting, no bullshit licensing or breaking backwards compatibility and promote it to people or whoever hosts this blogs. I think you are suggesting someone to replace his IDE with notepad since you can build application with notepad and gcc directly.

by sshine 5y ago

sdze 5y ago

> WordPress is insecure by design. Is there a proof for that?

blowski 5y ago

If the critics spent as much time building and selling what they see as the “better option” to WordPress, perhaps we wouldn’t be in this place. As it is, they just do the easy thing, playing “pigeon chess” by making these hackneyed, unsupported assertions. A better assessment is that WordPress has made trade-offs regarding security, as anybody in the real world must. Individuals must also make their own trade-offs, including whether to run WordPress at all, then how to configure it and which third-party code to use. Sometimes we get the trade-offs wrong, and that should affect how people make future decisions.

simion314 5y ago

>tl;dr: Use a static site generator. Most People that use WordPress are not develoeprs or technical people. Find similar product with a WYSIWYG GUI , theme , plugins, cheap hosting, no bullshit licensing or breaking backwards compatibility and promote it to people or whoever hosts this blogs. I think you are suggesting someone to replace his IDE with notepad since you can build application with notepad and gcc directly.